Loading…
Latest reads
Every post, summarised
Grounded summaries of engineering blogs, newest first. Each links to the original.
- 4,671 posts
- 20 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Latest posts
Mitigating CVE-2026-31431 (“Copy Fail”) in Docker Engine
CVE-2026-31431, dubbed Copy Fail, is a Linux kernel vulnerability in the AF_ALG crypto subsystem that allows unprivileged users to perform controlled writes to the page cache. Because default Docker Engine profiles permitted AF_ALG sockets, containers on unpatched host kernels could corrupt shared host page caches. Docker's initial mitigation in v29.4.2 blocked AF_ALG sockets and the socketcall syscall via seccomp, but entirely blocking socketcall broke 32-bit binaries and Go runtimes. To resolve compatibility issues, Docker Engine v29.4.3 reverted the seccomp socketcall block and adopted Linux Security Modules to enforce socket restrictions. The updated release configures AppArmor and SELinux policies to block AF_ALG creation across both direct and multiplexed syscall paths while retaining seccomp filtering for defense-in-depth.
Why Global Brands Need APAC Social Intelligence
Western-only social listening strategies can miss consumer conversations and early signals in APAC, where platforms shape culture, purchasing trends, and product discovery. APAC sources matter because RedNote (Xiaohongshu) combines search-led recommendations, reviews, lifestyle content, and social commerce, while WeChat connects messaging, communities, payments, e-commerce, customer service, and purchases across a customer lifecycle. Sina Weibo provides a fast-moving view of public sentiment, entertainment, influencer culture, launches, and controversies, with narratives sometimes spreading to global coverage and international platforms. Together, these sources show how trends form, buying decisions develop, and narratives evolve across regions, rather than only what people say about brands. The stated conclusion is that brands should expand listening beyond Western platforms to identify trends earlier, understand high-intent behavior in real time, and make more globally relevant decisions.
Building a FHIR-native health data platform on Databricks Lakebase
Healthcare organizations often keep a FHIR server, analytics warehouse, and ETL pipelines separate, replicating clinical data and fragmenting governance. The proposed architecture standardizes incoming HL7v2, C-CDA, X12, and proprietary data into FHIR using Health Samurai converters, terminology normalization, MDM/MPI deduplication, and Implementation Guide validation. Aidbox, Health Samurai's FHIR server and database, runs on Databricks Lakebase, while Moonlink synchronizes operational and analytical formats without ETL. This exposes one governed dataset through Spark, SQL, ML, AI/BI, FHIR API, SMART on FHIR, and SQL on FHIR ViewDefinitions. The architecture supports use cases including EHR optimization, value-based care, member engagement, and compliance capabilities, with insights connected to clinician and billing workflows through SMART on FHIR and CDS Hooks.
Role-Based Access Control for humans and agents
Modal announced Role-Based Access Control for Team and Enterprise users, enabling teams to grant agents and humans precise workspace access within Environments. Environments are workspace subdivisions with dedicated storage, apps, and limits, commonly set as dev-staging-production or per-developer. These now act as enforceable security boundaries through Restricted Environments, where workspace members are read-only by default and only explicitly assigned users or service users can deploy or manage resources. The RBAC system distinguishes human developers, AI agents, CI deployers, and external callers with recommended identities and environment access patterns, such as service users for agents and proxy auth tokens for external callers. Built on a new permissions architecture running for months, RBAC ties into Audit Logs and is the first of planned tools; future additions include spending limits and programmatic permissions.
Reachy Mini goes fully local
Reachy Mini’s conversation app can now run its speech stack locally instead of sending audio to a server, avoiding cloud, API keys, and data leaving the machine. The tutorial uses speech-to-speech as a cascaded VAD → STT → LLM → TTS pipeline exposed through a Realtime API-compatible /v1/realtime WebSocket, with Silero VAD v5, Parakeet-TDT 0.6B v3, Qwen3-TTS, and a selectable LLM backend. It shows llama.cpp serving Gemma 4 E4B with parallel slots, 64k context, flash attention, and full sliding-window attention, then covers vLLM, MLX, Transformers, hosted Responses API endpoints, and network connection to a wireless robot. Once the backend and app are connected, conversations run through the local loop, while individual stages can be exchanged to trade latency, quality, language coverage, and hardware choices.
Shipping a Trillion Parameters With a Hub Bucket: Delta Weight Sync in TRL
Async RL weight synchronization currently requires the trainer to send a complete model to the inference engine after each optimizer step, creating a critical-path transfer that can reach roughly a terabyte for a frontier 1T-parameter checkpoint. The article attributes the opportunity for reduction to bf16 arithmetic: at RL learning rates, many updates fall below the bf16 visibility threshold, leaving about 99% of weights bit-identical between steps and more than 98% even in the reported worst case. TRL's delta-weight-sync implementation records changed elements around the optimizer step, encodes them in sparse safetensors, uploads each delta to a Hugging Face Bucket, and lets vLLM fetch and apply it. On Qwen3-0.6B, this reduces each per-step payload from 1.2 GB to 20–35 MB, while a demonstrated setup connected separate trainer, vLLM, and Wordle Spaces through one bucket. Open issues include extra CPU bf16 snapshots, fixed anchor cadence, and unmeasured multi-node FSDP2 support.
Modern Java at Stripe: Language upgrades as a service
Large JVM codebases often stall Java upgrades because build-graph constraints require coordinated changes across many owners, while manual scripts and stale inventories repeatedly rediscover blockers. Stripe built AutoJDK to continuously analyze the live build graph, compute eligibility using reverse-dependency, runtime, framework, and dependency-ordering constraints, and generate bounded, idempotent pull requests rather than opaque rewrites. It also tracks adoption and blocker categories, uses AI assistance for selected remediation tasks, and can operate continuously or on specified packages and services. Centralized JDK and runtime policy, CI checks, multi-JDK support, static analysis, and packaging applications with platform-specific JDKs support gradual transitions. After three months, the upgrader had merged more than 160 PRs, made JDK 17 the most common target, eliminated Java 8 services, and reduced the JDK 8 and 11 footprint by roughly 25K targets.
Introducing House Mates: the ClickHouse partner community and program
ClickHouse introduces House Mates, a partner community and program bringing together more than 60 ISV, consulting, services, and channel partners to help customers build, scale, and procure ClickHouse solutions. The inaugural cohort includes over 25 ISVs developing validated, production-ready integrations—among them dbt Labs, Fivetran, Temporal, Grafana Labs, Confluent, and Sigma—and over 35 consulting, services, and reseller partners trained and certified through ClickHouse Academy. The program addresses an ecosystem with more than 200 integrations in the wild, demand for trusted regional expertise and preferred procurement channels, and the limits of managing partnerships through one-off arrangements. Its Ignite, Accelerate, and Prime tiers define progression from enablement and first projects or integrations to deeper go-to-market, incentives, co-innovation, and strategic collaboration at scale, while customers gain validated tools, regional experts, and preferred purchasing routes.
5 countries, 12 days, one ClickHouse: inside Alexey's APJ AI Tour
ClickHouse CTO and creator Alexey Milovidov completed a 12-day APJ tour spanning India, Singapore, Indonesia, South Korea, and Japan, with customer meetings, industry events, executive sessions, press interviews, and community meetups. The itinerary covered six cities and included three Confluent Data Streaming World Tour events, four ClickHouse meetups, and more than 10 enterprise customer meetings across varied industries and workloads. Discussions centered on real-time analytics, connected products, and analytics at industrial scale, while in-person conversations supplied feedback that the post says helps improve ClickHouse. The trip concluded with the ClickHouse Japan Launch Event on April 27, marking the company’s official entry into that market. The account presents physical presence as a way to extend ClickHouse’s open-building culture beyond GitHub and strengthen its feedback loop with APJ customers and communities.
Open House 2026 Day 1: Real-time data without lock-in and what teams can build next
ClickHouse’s Open House 2026 Day 1 announced updates spanning ClickHouse Cloud, Postgres, distributed query execution, observability, AI agents, and lakehouse interoperability. ClickHouse Postgres entered public beta with local NVMe storage, high availability, S3-backed point-in-time recovery, and a native CDC path into ClickHouse; early benchmarks reported more than 5x the transactions per second of AWS RDS. Multi-stage distributed queries repartition intermediate data between stages to scale joins and high-cardinality aggregations, reducing TPC-H SF100 runtime from 117.6 seconds on one node to 54.7 seconds on eight nodes. Additional launches included a Claude-powered ClickHouse Agents public beta, an AI-enhanced query builder, Monitoring v2, and Langfuse V4’s reported 200x query performance improvement, while the wrap-up framed the releases around real-time systems without lock-in.
Introducing ClickStack Cloud: Serverless observability powered by ClickHouse
ClickStack Cloud is entering private preview as a fully managed, serverless observability service built on ClickHouse for teams that want ClickHouse-powered logs, metrics, and traces without operating the underlying infrastructure. Users send OpenTelemetry data to a managed OTLP endpoint, while the service handles ingestion, durable buffering through an object-storage-backed event queue, scaling, storage, and query serving, then exposes telemetry in the ClickStack UI with integrated authentication and RBAC. The preview separates ingestion and query resources and is developing automatic tuning based on query patterns, including materialized fields, primary-key adjustments, materialized views, and indexes. Dedicated query compute for agentic and high-volume analytical workloads is planned after the preview, while pricing remains unfinished and the existing Managed ClickStack offering remains intended for teams requiring direct infrastructure and schema control.
Introducing CostBench: an open benchmark for data warehouse cost-performance
Traditional data warehouse benchmarks measure query execution speed without accounting for the varying compute costs across platforms. CostBench introduces an open benchmarking framework designed to evaluate data warehouses on a performance-per-dollar metric across both read and write workloads. Its initial release evaluates ClickHouse Cloud, Snowflake, Databricks, BigQuery, and Redshift using 43 production-derived analytical queries on an anonymized dataset combined with each vendor's compute billing model. In these read-side tests, ClickHouse Cloud maintained high speed at lower costs as data scaled, outperforming the nearest competitor by 23 times in cost-performance. The benchmark repository openly publishes its scripts, configurations, pricing assumptions, and raw JSON results to ensure all comparative metrics remain fully inspectable and reproducible.
Postgres managed by ClickHouse is now in beta
ClickHouse Cloud has launched a fully managed Postgres service in beta to combine transactional and analytical workloads within a single platform. Backed by local NVMe storage, the service provides up to ten times faster transactional performance alongside native change data capture into ClickHouse. Developers can query across both transactional and analytical layers using the pg_clickhouse extension without managing custom data pipelines. The platform also offers managed migration workflows via ClickPipes, database branching, point-in-time recovery, high availability with up to two standbys, and support for over ninety PostgreSQL extensions. More than fifty virtual machine configurations are available, ranging from single vCPU instances to clusters with ninety-six vCPUs and sixty terabytes of NVMe storage.
Introducing multi-stage distributed query execution in ClickHouse Cloud
ClickHouse Cloud introduced multi-stage distributed query execution to improve scaling for large joins and high-cardinality aggregations across multi-node clusters. Prior execution models relied on physical sharding or parallel replicas, which lacked the ability to freely repartition intermediate data between query stages. By splitting query plans into stages connected by exchange operators, worker nodes can shuffle, broadcast, scatter, or gather intermediate data during execution. In TPC-H benchmarks at scale factor 100 on eight nodes, total query time dropped from 117.6 seconds to 54.7 seconds, with scan-dominated queries showing near-linear 7.4x speedups. While currently in private preview with a rule-based planner, future work includes developing a cost-based optimizer to select optimal aggregation and join strategies automatically.
You don’t need to pick one: how Sentry and OpenTelemetry work together
Integrating Sentry into systems already instrumented with OpenTelemetry does not require replacing existing backend SDKs or rewriting service instrumentation. A hybrid architecture pairs the Sentry SDK on the frontend for browser tracing, Session Replay, and logs with existing OpenTelemetry configurations across backend services. Frontend requests propagate W3C traceparent headers to backend endpoints, which then export traces and logs over OTLP directly to Sentry endpoints or through an intermediate OpenTelemetry Collector. Ingested telemetry attaches backend spans and standard Python logs to the initial frontend user actions, establishing a unified distributed trace across the entire request path. Although Sentry's OTLP ingest currently supports logs and traces rather than metrics, dedicated backend Sentry SDKs remain an optional addition later for backend exception tracking and profiling.
Beyond the Menu Tree: How Yelp Built a Smarter Customer Success Chatbot with AI
Yelp transitioned from a legacy customer support chatbot that relied on rigid phrase matching and static menus to a retrieval-augmented generation system. The updated architecture classifies incoming queries using a large language model to route users into one of five specialized workflows, including QA, Billing, Refund, Cancel, and Review. For general QA, the system uses FAISS to search an in-memory vectorstore built exclusively from article metadata such as titles, summaries, and headers rather than raw article text. Retrieved articles are supplied to the language model as prompt context, followed by automated validations for safety, character limits, and hallucinated hyperlinks. In production A/B testing, this metadata-driven design doubled the chatbot resolution rate while achieving approximately 94% recall@5.
Use Passkeys Wherever You Sign in to Uber
Uber rolled out passkey authentication across mobile apps and websites, allowing users to sign in without passwords. Passkeys use a device-generated public-private key pair: the server stores the public key, while the device’s password manager protects the private key and requires biometric, PIN, or pattern authorization. Registration sends creation options and a challenge to the authenticator, which returns an attestation for server validation; sign-in similarly returns a signed assertion that the server verifies with the stored public key. This design keeps private keys and user authorization data on the authenticator, improving resistance to phishing, credential stuffing, brute force, and replay attacks. Uber reported low initial adoption and noted inconsistent browser and device support, user education needs, and technical complexity; it plans to use adoption data and post-authentication prompts to improve onboarding.
AI readiness in telecommunications
Telecommunications companies are adopting AI for customer experience, network operations, and cost reduction, yet initiatives often stall before production because fragmented, ungoverned, semantically opaque data creates data debt. The post argues that AI readiness depends on a semantic layer unifying datasets and business definitions, governance, and catalog metadata across systems such as Oracle, Snowflake, Salesforce, ServiceNow, and Databricks. It presents Unity Catalog as the proposed foundation, using Delta Sharing, Lakeflow Connectors, and Lakehouse Federation to exchange, ingest, or query data without uniformly replicating it, while privilege-aware metadata and audit logging support compliance. Metric Views, lineage, tags, and glossaries give agents authoritative meanings for measures and terms such as revenue, ARPU, active user, and FTTH. The conclusion is that trustworthy operational AI requires a governed, unified data foundation and organizational commitment, not simply more capable models.
Shaping Product Understanding with Contrastive Reinforcement Learning
Etsy’s search and recommendation systems need product representations that capture distinguishing details—such as materials, craft, and visual style—beyond categories and titles, despite noisy listing data, varied inventory, and latency constraints. The approach fine-tunes the open-source Qwen3-VL-8B on query, engaged-listing, and non-engaged-listing triplets, generating candidate summaries and scoring them with a frozen two-tower dense retriever. Group Relative Policy Optimization (GRPO) uses the query–engaged versus query–non-engaged similarity margin as a joint reward, encouraging grounded summaries that separate alternatives rather than generic keyword stuffing. Human review found specific, accurate details beyond titles, while adding the summaries to Etsy’s Semantic Relevance model improved macro F1 by 8.7% relative to description n-grams. Online production experiments are planned.
Your agent can't fix what it can't see
Coding agents frequently fail to resolve production bugs when restricted to source code alone, as they lack critical runtime context such as stack traces, breadcrumbs, and environment data. To bridge this gap, Sentry introduces Sentry MCP and the Sentry CLI to supply agents and developers with structured production telemetry. The Model Context Protocol integration supports clients like Claude Code, Cursor, and VS Code, while the CLI enables scripted workflows. When an alert triggers, an agent uses trace and commit metadata to diagnose root causes across service boundaries, generate regression tests, and open draft pull requests. Over six months, the Autofix pull request merge rate increased from 41% to 46%.
Top topics
- Architecture834
- Performance816
- LLMs660
- Machine Learning622
- Open Source563
- AI Agents553
- AI470
- Developer Experience448
Weekly digest
The best engineering reads, once a week.